@lovable.dev/mcp-js 0.27.1 → 0.28.0

package/README.md

@@ -211,7 +211,7 @@ Use `auth.oauth.issuer(...)`, set `resource` or `acceptedAudiences` to anchor th
 
 ## Debug logging
 
-The runtime is silent by default. Raise the log level to trace OAuth discovery, JWKS resolution, and token verification when a deployed MCP server returns `401`/`500` and you need to see why. Logs go to `console` (so they land in your platform's function logs) and **never include the bearer token, full claims, or PII** — only non-secret fields such as the JWT header `alg`/`kid`, `issuer`, `jwks_uri`, the token `sub`/`client_id`/`scopes`, and `jose` error codes.
+The runtime logs operational events (tool invocations, auth outcomes, warnings, errors) at `info` by default. Raise the level to `debug` to trace OAuth discovery, JWKS resolution, and token verification when a deployed MCP server returns `401`/`500` and you need to see why. Logs go to `console` (so they land in your platform's function logs) and **never include the bearer token, full claims, or PII** — only non-secret fields such as the JWT header `alg`/`kid`, `issuer`, `jwks_uri`, the token `scopes`, and `jose` error codes. End-user identifiers (the token `sub`/`client_id`) appear only at `debug`, as the `oauth.verify.principal` event — the default `info` level never collects them.
 
 Enable it either way:
 
@@ -222,17 +222,17 @@ setLogLevel("debug"); // "silent" | "error" | "warn" | "info" | "debug"
 ```
 
 ```bash
-# Or via env var, read once at startup. Node/Deno only: it reads `process.env`,
-# which is absent on a deployed Cloudflare Worker (env arrives via bindings), so
-# the var is silently ignored there — use `setLogLevel()` on Workers.
+# Or via env var. Node reads it at startup; on Deno and Cloudflare Workers the
+# recorder applies it at the first request's telemetry emit, so logs before that
+# point may not honor it — prefer `setLogLevel()` there.
 LOVABLE_MCP_LOG_LEVEL=debug
 ```
 
-A `500` on an OAuth-protected route is always one of two causes, logged at `error`: an `OAuthConfigurationError` from issuer-metadata discovery or a JWKS *fetch* failure (`oauth.discovery.config_error` / `oauth.jwks.fetch_failed` → `auth.config_error`), or a transport-level fault in the MCP handler (`mcp.transport_error`). Auth outcomes are logged at `info`: a granted request as `oauth.verify.ok`, and a `401`/`403` as `auth.token_rejected` (with the `jose` reason) or `auth.no_bearer_token` — so a request rejected for insufficient scope shows both `oauth.verify.ok` and the `auth.token_rejected` that follows it.
+A `500` on an OAuth-protected route is always one of two causes, logged at `error`: an `OAuthConfigurationError` from issuer-metadata discovery or a JWKS *fetch* failure (`oauth.discovery.config_error` / `oauth.jwks.fetch_failed` → `auth.config_error`), or a transport-level fault in the MCP handler (`mcp.transport_error`). Auth outcomes are logged at `info`: a granted request as `oauth.verify.ok`, a request with no parseable bearer as `auth.no_bearer_token`, and a rejected token as `auth.token_rejected` (a `jose` rejection such as an expired token carries the `jose` error name and code; the full reason appears at `debug` as `oauth.verify.rejected`) — so a request rejected for insufficient scope shows both `oauth.verify.ok` and the `auth.token_rejected` that follows it. A sustained flood of `auth.token_rejected` whose `code` is `ERR_JOSE_NOT_SUPPORTED` or `ERR_JOSE_ALG_NOT_ALLOWED` (rather than `ERR_JWT_EXPIRED`) points at server-side key or algorithm configuration, not client error.
 
 ## Usage metrics
 
-Each MCP server records per-invocation telemetry — tool name, JSON-RPC method, outcome (`ok` / `handler_error` / `transport_error`), and latency — and POSTs it in fire-and-forget batches as **OTLP/HTTP JSON logs**. No tool arguments or response payloads are ever captured. Emission is **on by default**, self-disables at runtime when `LOVABLE_API_KEY` is absent (so a local `vite dev` stays silent), and degrades silently — a failed flush never blocks or fails a tool call.
+Each MCP server records per-invocation telemetry — tool name, JSON-RPC method, outcome, and latency — as **OTLP/HTTP JSON logs**, one awaited POST per record, bounded by a 3-second timeout; a failed or slow POST is logged (`metrics.failed`) and swallowed, never failing the request. Outcomes cover tool results (`ok`, `tool_error`, `handler_error`, `transport_error`) and the authorization gate: `auth_challenge` for an unauthenticated request answered with the `401` challenge (so probe traffic produces records), and the `auth_*` discovery/JWKS failure outcomes. No tool arguments or response payloads are ever captured. Emission is **on by default** and self-disables at runtime when `LOVABLE_API_KEY` is absent: records are dropped and one `metrics.disabled_no_api_key` warning is logged per process, so a local `vite dev` stays quiet. With `metrics: false` the recorder never runs — on Deno and Cloudflare Workers that also means `LOVABLE_MCP_LOG_LEVEL` is never applied (use `setLogLevel()` instead).
 
 Configure it on the MCP definition:
 

package/dist/{authorize-FOlzhxrM.js → authorize--rUeMOGU.js}

@@ -1,7 +1,7 @@
-import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-rGakBvJ1.js";
-import { t as version } from "./package-dtiombMt.js";
+import { i as log, n as applyLogLevelFromEnv, o as parseSafeUrl, r as describeError, s as trimTrailingSlash, t as LOG_LEVEL_ENV_VAR, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
+import { t as version } from "./package-DgiA0xuY.js";
 import "./metadata-path-CAkNcfyY.js";
-import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
+import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/core/cors.ts
 const EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
 const ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
@@ -73,6 +73,7 @@ function toLogRecord(rec) {
 	if (rec.tool !== null) attributes.push(strAttr("mcp.tool", rec.tool));
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
+	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -120,6 +121,8 @@ function nowUnixNano() {
 function nowMs() {
 	return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 }
+const METRICS_POST_TIMEOUT_MS = 3e3;
+let warnedNoApiKey = false;
 const NOOP_RECORDER = { async emit() {} };
 function createNoopRecorder() {
 	return NOOP_RECORDER;
@@ -168,7 +171,7 @@ var BaseMetricRecorder = class {
 	}
 	async emit(ev) {
 		await this.applyLazyLogLevel();
-		log.info("tool.invoked", {
+		if (ev.outcome !== "auth_challenge") log.info("tool.invoked", {
 			tool: ev.tool,
 			method: ev.method,
 			outcome: ev.outcome,
@@ -181,30 +184,34 @@ var BaseMetricRecorder = class {
 			log.warn("metrics.disabled_no_fetch", { endpoint: this.config.endpoint });
 			return;
 		}
-		const headers = { ...this.baseHeaders };
-		if (this.usesLovableEndpoint) {
-			const key = await this.resolveApiKey();
-			if (!key) {
-				log.warn("metrics.disabled_no_api_key", {
-					envVar: this.config.apiKeyEnvVar,
-					endpoint: this.config.endpoint
-				});
-				return;
-			}
-			headers.authorization = `Bearer ${key}`;
-		}
-		const { errorText: _localOnly, ...wireEvent } = ev;
-		const body = buildLogsPayload([{
-			...wireEvent,
-			timeUnixNano: nowUnixNano(),
-			stack: this.stack
-		}], this.server);
 		try {
+			const headers = { ...this.baseHeaders };
+			if (this.usesLovableEndpoint) {
+				const key = await this.resolveApiKey();
+				if (!key) {
+					if (!warnedNoApiKey) {
+						warnedNoApiKey = true;
+						log.warn("metrics.disabled_no_api_key", {
+							envVar: this.config.apiKeyEnvVar,
+							endpoint: this.config.endpoint
+						});
+					}
+					return;
+				}
+				headers.authorization = `Bearer ${key}`;
+			}
+			const { errorText: _localOnly, ...wireEvent } = ev;
+			const body = buildLogsPayload([{
+				...wireEvent,
+				timeUnixNano: nowUnixNano(),
+				stack: this.stack
+			}], this.server);
 			const res = await this.doFetch(this.config.endpoint, {
 				method: "POST",
 				headers,
 				body,
-				keepalive: true
+				keepalive: true,
+				signal: AbortSignal.timeout(METRICS_POST_TIMEOUT_MS)
 			});
 			if (!res.ok) log.warn("metrics.rejected", {
 				status: res.status,
@@ -295,8 +302,8 @@ var SupabaseMetricRecorder = class extends BaseMetricRecorder {
 //#endregion
 //#region src/metrics/recorder.ts
 /** Vend the recorder for a stack, in-flight per request. Returns a no-op when
-*  metrics are disabled (`metrics: false`); otherwise the stack-specific class,
-*  which still logs `tool.invoked` even if the key or endpoint is unavailable. */
+*  metrics are disabled (`metrics: false`); otherwise the stack-specific class, which
+*  logs `tool.invoked` for tool invocations even if the key or endpoint is unavailable. */
 function createRecorderForRuntime(mcp, opts) {
 	const config = resolveMetricsConfig(mcp.metrics);
 	const server = {
@@ -593,6 +600,16 @@ async function fetchVerificationKeySet(jwksUri) {
 		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
 	}
 }
+function assertCompactJwsShape(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+		log.debug("oauth.verify.bad_shape", {
+			tokenLength: token.length,
+			outcome: "401 invalid_token"
+		});
+		throw new OAuthTokenError(401, "invalid_token", "Access token is not a JWT");
+	}
+}
 function assertAccessTokenTyp(token, allowed) {
 	let header;
 	try {
@@ -694,6 +711,8 @@ function buildMcpAuthContext(args) {
 function createOAuthTokenVerifier(auth, discovery) {
 	const allowedTyps = auth.accessTokenTyp ?? DEFAULT_ACCESS_TOKEN_TYPS;
 	return async (token, request, options) => {
+		assertCompactJwsShape(token);
+		assertAccessTokenTyp(token, allowedTyps);
 		const resource = resolveProtectedResource(auth, request, options);
 		const issuer = await discovery.resolveIssuer();
 		const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
@@ -705,9 +724,7 @@ function createOAuthTokenVerifier(auth, discovery) {
 		});
 		const jwksUri = await discovery.resolveJwksUri();
 		log.debug("oauth.jwks.fetch", { jwksUri });
-		const keySet = await fetchVerificationKeySet(jwksUri);
-		assertAccessTokenTyp(token, allowedTyps);
-		const claims = await verifyJwtClaims(token, keySet, issuer, auth);
+		const claims = await verifyJwtClaims(token, await fetchVerificationKeySet(jwksUri), issuer, auth);
 		const audienceVia = checkAcceptedAudience(claims, acceptedAudiences, auth);
 		assertNonEmptySubject(claims);
 		const context = buildMcpAuthContext({
@@ -719,11 +736,13 @@ function createOAuthTokenVerifier(auth, discovery) {
 		});
 		assertOAuthClientClaim(auth, context.principal.clientId);
 		log.info("oauth.verify.ok", {
-			sub: context.principal.sub,
-			clientId: context.principal.clientId,
 			scopes: context.principal.scopes,
 			audienceVia
 		});
+		log.debug("oauth.verify.principal", {
+			sub: context.principal.sub,
+			clientId: context.principal.clientId
+		});
 		return context;
 	};
 }
@@ -776,6 +795,22 @@ function oauthUpstreamUnreachableResponse() {
 		}
 	});
 }
+const KNOWN_HTTP_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"DELETE",
+	"PATCH",
+	"OPTIONS",
+	"TRACE",
+	"CONNECT",
+	"QUERY"
+]);
+function normalizeHttpMethod(method) {
+	const upper = method.toUpperCase();
+	return KNOWN_HTTP_METHODS.has(upper) ? upper : "_OTHER";
+}
 function parseBearerToken(request) {
 	const header = request.headers.get("Authorization");
 	if (!header) return void 0;
@@ -838,7 +873,18 @@ function createRequestAuthorizer(mcp, options = {}) {
 		const startedAt = nowMs();
 		const token = parseBearerToken(request);
 		if (!token) {
-			log.info("auth.no_bearer_token", { outcome: "401" });
+			const httpMethod = normalizeHttpMethod(request.method);
+			log.info("auth.no_bearer_token", {
+				httpMethod,
+				outcome: "401"
+			});
+			await recorder?.emit({
+				tool: null,
+				method: "authorize",
+				outcome: "auth_challenge",
+				httpMethod,
+				durationMs: nowMs() - startedAt
+			});
 			return {
 				ok: false,
 				response: challengeResponse(runtime.auth, request, runtime.options, 401)
@@ -896,7 +942,12 @@ function createRequestAuthorizer(mcp, options = {}) {
 					response: challengeResponse(runtime.auth, request, runtime.options, err.status, err.oauthError, err.message)
 				};
 			}
-			log.error("auth.unexpected_error", {
+			if (err instanceof errors.JOSEError) log.info("auth.token_rejected", {
+				...describeError(err),
+				status: 401,
+				oauthError: "invalid_token"
+			});
+			else log.error("auth.unexpected_error", {
 				...describeError(err),
 				outcome: "401"
 			});

package/dist/{authorize-CB35c3Wg.cjs → authorize-ChY44o_1.cjs}

@@ -1,5 +1,5 @@
-const require_logger = require("./logger-BkMMCFTv.cjs");
-const require_package = require("./package-BdaLbzEh.cjs");
+const require_logger = require("./logger-CN1q-KNn.cjs");
+const require_package = require("./package-CGLPZwz-.cjs");
 require("./metadata-path-zd7NSNoa.cjs");
 let jose = require("jose");
 //#region src/core/cors.ts
@@ -73,6 +73,7 @@ function toLogRecord(rec) {
 	if (rec.tool !== null) attributes.push(strAttr("mcp.tool", rec.tool));
 	if (rec.reqBytes !== void 0) attributes.push(intAttr("mcp.request_size_bytes", rec.reqBytes));
 	if (rec.resBytes !== void 0) attributes.push(intAttr("mcp.response_size_bytes", rec.resBytes));
+	if (rec.httpMethod !== void 0) attributes.push(strAttr("http.request.method", rec.httpMethod));
 	attributes.push(strAttr("mcp.stack", rec.stack));
 	if (rec.endUserId !== void 0) attributes.push(strAttr("mcp.end_user_id", rec.endUserId));
 	return {
@@ -120,6 +121,8 @@ function nowUnixNano() {
 function nowMs() {
 	return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
 }
+const METRICS_POST_TIMEOUT_MS = 3e3;
+let warnedNoApiKey = false;
 const NOOP_RECORDER = { async emit() {} };
 function createNoopRecorder() {
 	return NOOP_RECORDER;
@@ -168,7 +171,7 @@ var BaseMetricRecorder = class {
 	}
 	async emit(ev) {
 		await this.applyLazyLogLevel();
-		require_logger.log.info("tool.invoked", {
+		if (ev.outcome !== "auth_challenge") require_logger.log.info("tool.invoked", {
 			tool: ev.tool,
 			method: ev.method,
 			outcome: ev.outcome,
@@ -181,30 +184,34 @@ var BaseMetricRecorder = class {
 			require_logger.log.warn("metrics.disabled_no_fetch", { endpoint: this.config.endpoint });
 			return;
 		}
-		const headers = { ...this.baseHeaders };
-		if (this.usesLovableEndpoint) {
-			const key = await this.resolveApiKey();
-			if (!key) {
-				require_logger.log.warn("metrics.disabled_no_api_key", {
-					envVar: this.config.apiKeyEnvVar,
-					endpoint: this.config.endpoint
-				});
-				return;
-			}
-			headers.authorization = `Bearer ${key}`;
-		}
-		const { errorText: _localOnly, ...wireEvent } = ev;
-		const body = buildLogsPayload([{
-			...wireEvent,
-			timeUnixNano: nowUnixNano(),
-			stack: this.stack
-		}], this.server);
 		try {
+			const headers = { ...this.baseHeaders };
+			if (this.usesLovableEndpoint) {
+				const key = await this.resolveApiKey();
+				if (!key) {
+					if (!warnedNoApiKey) {
+						warnedNoApiKey = true;
+						require_logger.log.warn("metrics.disabled_no_api_key", {
+							envVar: this.config.apiKeyEnvVar,
+							endpoint: this.config.endpoint
+						});
+					}
+					return;
+				}
+				headers.authorization = `Bearer ${key}`;
+			}
+			const { errorText: _localOnly, ...wireEvent } = ev;
+			const body = buildLogsPayload([{
+				...wireEvent,
+				timeUnixNano: nowUnixNano(),
+				stack: this.stack
+			}], this.server);
 			const res = await this.doFetch(this.config.endpoint, {
 				method: "POST",
 				headers,
 				body,
-				keepalive: true
+				keepalive: true,
+				signal: AbortSignal.timeout(METRICS_POST_TIMEOUT_MS)
 			});
 			if (!res.ok) require_logger.log.warn("metrics.rejected", {
 				status: res.status,
@@ -295,8 +302,8 @@ var SupabaseMetricRecorder = class extends BaseMetricRecorder {
 //#endregion
 //#region src/metrics/recorder.ts
 /** Vend the recorder for a stack, in-flight per request. Returns a no-op when
-*  metrics are disabled (`metrics: false`); otherwise the stack-specific class,
-*  which still logs `tool.invoked` even if the key or endpoint is unavailable. */
+*  metrics are disabled (`metrics: false`); otherwise the stack-specific class, which
+*  logs `tool.invoked` for tool invocations even if the key or endpoint is unavailable. */
 function createRecorderForRuntime(mcp, opts) {
 	const config = require_logger.resolveMetricsConfig(mcp.metrics);
 	const server = {
@@ -593,6 +600,16 @@ async function fetchVerificationKeySet(jwksUri) {
 		throw new OAuthConfigurationError(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`, "jwks");
 	}
 }
+function assertCompactJwsShape(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+		require_logger.log.debug("oauth.verify.bad_shape", {
+			tokenLength: token.length,
+			outcome: "401 invalid_token"
+		});
+		throw new OAuthTokenError(401, "invalid_token", "Access token is not a JWT");
+	}
+}
 function assertAccessTokenTyp(token, allowed) {
 	let header;
 	try {
@@ -694,6 +711,8 @@ function buildMcpAuthContext(args) {
 function createOAuthTokenVerifier(auth, discovery) {
 	const allowedTyps = auth.accessTokenTyp ?? DEFAULT_ACCESS_TOKEN_TYPS;
 	return async (token, request, options) => {
+		assertCompactJwsShape(token);
+		assertAccessTokenTyp(token, allowedTyps);
 		const resource = resolveProtectedResource(auth, request, options);
 		const issuer = await discovery.resolveIssuer();
 		const acceptedAudiences = resolveAcceptedAudiences(auth, resource);
@@ -705,9 +724,7 @@ function createOAuthTokenVerifier(auth, discovery) {
 		});
 		const jwksUri = await discovery.resolveJwksUri();
 		require_logger.log.debug("oauth.jwks.fetch", { jwksUri });
-		const keySet = await fetchVerificationKeySet(jwksUri);
-		assertAccessTokenTyp(token, allowedTyps);
-		const claims = await verifyJwtClaims(token, keySet, issuer, auth);
+		const claims = await verifyJwtClaims(token, await fetchVerificationKeySet(jwksUri), issuer, auth);
 		const audienceVia = checkAcceptedAudience(claims, acceptedAudiences, auth);
 		assertNonEmptySubject(claims);
 		const context = buildMcpAuthContext({
@@ -719,11 +736,13 @@ function createOAuthTokenVerifier(auth, discovery) {
 		});
 		assertOAuthClientClaim(auth, context.principal.clientId);
 		require_logger.log.info("oauth.verify.ok", {
-			sub: context.principal.sub,
-			clientId: context.principal.clientId,
 			scopes: context.principal.scopes,
 			audienceVia
 		});
+		require_logger.log.debug("oauth.verify.principal", {
+			sub: context.principal.sub,
+			clientId: context.principal.clientId
+		});
 		return context;
 	};
 }
@@ -776,6 +795,22 @@ function oauthUpstreamUnreachableResponse() {
 		}
 	});
 }
+const KNOWN_HTTP_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"DELETE",
+	"PATCH",
+	"OPTIONS",
+	"TRACE",
+	"CONNECT",
+	"QUERY"
+]);
+function normalizeHttpMethod(method) {
+	const upper = method.toUpperCase();
+	return KNOWN_HTTP_METHODS.has(upper) ? upper : "_OTHER";
+}
 function parseBearerToken(request) {
 	const header = request.headers.get("Authorization");
 	if (!header) return void 0;
@@ -838,7 +873,18 @@ function createRequestAuthorizer(mcp, options = {}) {
 		const startedAt = nowMs();
 		const token = parseBearerToken(request);
 		if (!token) {
-			require_logger.log.info("auth.no_bearer_token", { outcome: "401" });
+			const httpMethod = normalizeHttpMethod(request.method);
+			require_logger.log.info("auth.no_bearer_token", {
+				httpMethod,
+				outcome: "401"
+			});
+			await recorder?.emit({
+				tool: null,
+				method: "authorize",
+				outcome: "auth_challenge",
+				httpMethod,
+				durationMs: nowMs() - startedAt
+			});
 			return {
 				ok: false,
 				response: challengeResponse(runtime.auth, request, runtime.options, 401)
@@ -896,7 +942,12 @@ function createRequestAuthorizer(mcp, options = {}) {
 					response: challengeResponse(runtime.auth, request, runtime.options, err.status, err.oauthError, err.message)
 				};
 			}
-			require_logger.log.error("auth.unexpected_error", {
+			if (err instanceof jose.errors.JOSEError) require_logger.log.info("auth.token_rejected", {
+				...require_logger.describeError(err),
+				status: 401,
+				oauthError: "invalid_token"
+			});
+			else require_logger.log.error("auth.unexpected_error", {
 				...require_logger.describeError(err),
 				outcome: "401"
 			});

package/dist/{base-CReh7d3E.d.cts → base-CUkmyaXJ.d.cts}

@@ -1,18 +1,21 @@
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and
  *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
 interface InvocationRecord {
-  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
   tool: string | null;
-  /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
   method: string;
   outcome: InvocationOutcome;
   durationMs: number;
   reqBytes?: number;
   resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/{base-CReh7d3E.d.ts → base-CUkmyaXJ.d.ts}

@@ -1,18 +1,21 @@
 //#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
+type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
 /** One recorded MCP call. Carries no arguments or response payloads — only the
  *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
  *  `errorText` is the sole exception: it is logged locally for debugging and
  *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
 interface InvocationRecord {
-  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and auth-config failures. */
+  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
   tool: string | null;
-  /** JSON-RPC method, e.g. `tools/call`; `authorize` for auth-config failures. */
+  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
   method: string;
   outcome: InvocationOutcome;
   durationMs: number;
   reqBytes?: number;
   resBytes?: number;
+  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
+   *  POST discovery) is distinguishable; absent on tool-call records. */
+  httpMethod?: string;
   /** The app end-user that made the call (the access token `sub`), or
    *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
   endUserId?: string;

package/dist/cli/extract-manifest.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-const require_package = require("../package-BdaLbzEh.cjs");
-const require_list_tools = require("../list-tools-DiMCRunS.cjs");
+const require_package = require("../package-CGLPZwz-.cjs");
+const require_list_tools = require("../list-tools-DCF6G4fn.cjs");
 const require_fs_errors = require("../fs-errors-CWNzOV75.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/cli/extract-manifest.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as version } from "../package-dtiombMt.js";
-import { t as buildMcpListing } from "../list-tools-Dt-mhh52.js";
+import { t as version } from "../package-DgiA0xuY.js";
+import { t as buildMcpListing } from "../list-tools-BLGr7mot.js";
 import { t as isFileMissing } from "../fs-errors-PA2t1TIp.js";
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{gate-BeHmyGxk.js → gate-BiM6EBeA.js}

@@ -1,4 +1,4 @@
-import { c as createNoopRecorder, d as finalizeWireResponse, p as corsPreflightResponse } from "./authorize-FOlzhxrM.js";
+import { c as createNoopRecorder, d as finalizeWireResponse, p as corsPreflightResponse } from "./authorize--rUeMOGU.js";
 //#region src/protocols/gate.ts
 function createGatedHandler(gate) {
 	const allow = [...gate.methods, "OPTIONS"].join(", ");

package/dist/{gate-B9RSzvoI.cjs → gate-CGZl0gjJ.cjs}

@@ -1,4 +1,4 @@
-const require_authorize = require("./authorize-CB35c3Wg.cjs");
+const require_authorize = require("./authorize-ChY44o_1.cjs");
 //#region src/protocols/gate.ts
 function createGatedHandler(gate) {
 	const allow = [...gate.methods, "OPTIONS"].join(", ");

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("./logger-BkMMCFTv.cjs");
+const require_logger = require("./logger-CN1q-KNn.cjs");
 const require_errors = require("./errors-CN6Da8iz.cjs");
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-rGakBvJ1.js";
+import { a as setLogLevel, o as parseSafeUrl, s as trimTrailingSlash, u as resolveMetricsConfig } from "./logger-Ctv5xUSD.js";
 import { i as ToolContext, t as ToolError } from "./errors-DSe96Ffd.js";
 //#region src/core/define.ts
 function assertUniqueNames(mcp) {

package/dist/{io--MeYrWG7.d.ts → io-SMlD5WeX.d.ts}

@@ -1,4 +1,4 @@
-import "./list-tools-Bku6XkVc.js";
+import "./list-tools-BAqQVIHk.js";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{io-BzTGjG_c.d.cts → io-VBHO8YH_.d.cts}

@@ -1,4 +1,4 @@
-import "./list-tools-Cn7tpE0V.cjs";
+import "./list-tools-BN97L2Yv.cjs";
 //#region src/manifest/io.d.ts
 /**
  * Shape every MCP Vite plugin exposes on its `api` so `runExtract` can read

package/dist/{list-tools-Bku6XkVc.d.ts → list-tools-BAqQVIHk.d.ts}

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "./types-C0Wgm9zp.js";
-import { t as MetricsRecorder } from "./base-CReh7d3E.js";
+import { t as MetricsRecorder } from "./base-CUkmyaXJ.js";
 import { t as McpRuntimeOptions } from "./authorize-Cs1yyLrq.js";
 //#region src/protocols/rest/list-tools.d.ts
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/{list-tools-Dt-mhh52.js → list-tools-BLGr7mot.js}

@@ -1,5 +1,5 @@
-import { f as methodNotAllowed, n as createRequestAuthorizer, t as assertRestResourceBinding } from "./authorize-FOlzhxrM.js";
-import { t as createGatedHandler } from "./gate-BeHmyGxk.js";
+import { f as methodNotAllowed, n as createRequestAuthorizer, t as assertRestResourceBinding } from "./authorize--rUeMOGU.js";
+import { t as createGatedHandler } from "./gate-BiM6EBeA.js";
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
 //#region src/protocols/rest/list-tools.ts

package/dist/{list-tools-Cn7tpE0V.d.cts → list-tools-BN97L2Yv.d.cts}

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "./types-C0Wgm9zp.cjs";
-import { t as MetricsRecorder } from "./base-CReh7d3E.cjs";
+import { t as MetricsRecorder } from "./base-CUkmyaXJ.cjs";
 import { t as McpRuntimeOptions } from "./authorize-BcNuNPtP.cjs";
 //#region src/protocols/rest/list-tools.d.ts
 type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/{list-tools-DiMCRunS.cjs → list-tools-DCF6G4fn.cjs}

@@ -1,5 +1,5 @@
-const require_authorize = require("./authorize-CB35c3Wg.cjs");
-const require_gate = require("./gate-B9RSzvoI.cjs");
+const require_authorize = require("./authorize-ChY44o_1.cjs");
+const require_gate = require("./gate-CGZl0gjJ.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 let _modelcontextprotocol_sdk_server_zod_json_schema_compat_js = require("@modelcontextprotocol/sdk/server/zod-json-schema-compat.js");
 //#region src/protocols/rest/list-tools.ts

package/dist/{logger-BkMMCFTv.cjs → logger-CN1q-KNn.cjs}

@@ -84,13 +84,12 @@ function isLogLevel(value) {
 const LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
 function readEnvLevel() {
 	try {
-		const normalized = (typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0)?.trim().toLowerCase();
-		return isLogLevel(normalized) ? normalized : void 0;
+		return parseLogLevel(typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0);
 	} catch {
 		return;
 	}
 }
-let currentLevel = readEnvLevel() ?? "debug";
+let currentLevel = readEnvLevel() ?? "info";
 /**
 * Set the runtime log level programmatically. Use this when the deployment can't
 * surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
@@ -108,11 +107,12 @@ function parseLogLevel(raw) {
 	return isLogLevel(normalized) ? normalized : void 0;
 }
 /**
-* Apply the log level from an env value: use it when it names a valid level,
-* otherwise fall back to `debug` so the SDK's diagnostics are on by default.
+* Apply the log level from an env value when it names a valid level; otherwise
+* leave the current level alone so a programmatic `setLogLevel` sticks.
 */
 function applyLogLevelFromEnv(raw) {
-	setLogLevel(parseLogLevel(raw) ?? "debug");
+	const level = parseLogLevel(raw);
+	if (level !== void 0) setLogLevel(level);
 }
 function enabled(level) {
 	return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];

package/dist/{logger-rGakBvJ1.js → logger-Ctv5xUSD.js}

@@ -84,13 +84,12 @@ function isLogLevel(value) {
 const LOG_LEVEL_ENV_VAR = "LOVABLE_MCP_LOG_LEVEL";
 function readEnvLevel() {
 	try {
-		const normalized = (typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0)?.trim().toLowerCase();
-		return isLogLevel(normalized) ? normalized : void 0;
+		return parseLogLevel(typeof process !== "undefined" ? process.env?.[LOG_LEVEL_ENV_VAR] : void 0);
 	} catch {
 		return;
 	}
 }
-let currentLevel = readEnvLevel() ?? "debug";
+let currentLevel = readEnvLevel() ?? "info";
 /**
 * Set the runtime log level programmatically. Use this when the deployment can't
 * surface `LOVABLE_MCP_LOG_LEVEL` to the package (e.g. a Cloudflare Worker that
@@ -108,11 +107,12 @@ function parseLogLevel(raw) {
 	return isLogLevel(normalized) ? normalized : void 0;
 }
 /**
-* Apply the log level from an env value: use it when it names a valid level,
-* otherwise fall back to `debug` so the SDK's diagnostics are on by default.
+* Apply the log level from an env value when it names a valid level; otherwise
+* leave the current level alone so a programmatic `setLogLevel` sticks.
 */
 function applyLogLevelFromEnv(raw) {
-	setLogLevel(parseLogLevel(raw) ?? "debug");
+	const level = parseLogLevel(raw);
+	if (level !== void 0) setLogLevel(level);
 }
 function enabled(level) {
 	return LEVEL_RANK[level] <= LEVEL_RANK[currentLevel];

package/dist/{mcp-ECo1Ixk8.cjs → mcp-CUGwXkxb.cjs}

@@ -1,8 +1,8 @@
-const require_logger = require("./logger-BkMMCFTv.cjs");
+const require_logger = require("./logger-CN1q-KNn.cjs");
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_authorize = require("./authorize-CB35c3Wg.cjs");
+const require_authorize = require("./authorize-ChY44o_1.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
-const require_gate = require("./gate-B9RSzvoI.cjs");
+const require_gate = require("./gate-CGZl0gjJ.cjs");
 let _modelcontextprotocol_sdk_server_mcp_js = require("@modelcontextprotocol/sdk/server/mcp.js");
 let _modelcontextprotocol_sdk_server_webStandardStreamableHttp_js = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
 //#region src/protocols/mcp/protocol.ts

package/dist/{mcp-DiVQhHIw.js → mcp-Czp-hHjN.js}

@@ -1,8 +1,8 @@
-import { i as log, r as describeError } from "./logger-rGakBvJ1.js";
+import { i as log, r as describeError } from "./logger-Ctv5xUSD.js";
 import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DSe96Ffd.js";
-import { l as nowMs, n as createRequestAuthorizer } from "./authorize-FOlzhxrM.js";
+import { l as nowMs, n as createRequestAuthorizer } from "./authorize--rUeMOGU.js";
 import { t as extractTextContent } from "./content-D5LJAHyM.js";
-import { t as createGatedHandler } from "./gate-BeHmyGxk.js";
+import { t as createGatedHandler } from "./gate-BiM6EBeA.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 //#region src/protocols/mcp/protocol.ts

package/dist/{package-BdaLbzEh.cjs → package-CGLPZwz-.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.27.1";
+var version = "0.28.0";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/{package-dtiombMt.js → package-DgiA0xuY.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.27.1";
+var version = "0.28.0";
 //#endregion
 export { version as t };

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-ECo1Ixk8.cjs");
+const require_mcp = require("../../mcp-CUGwXkxb.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as MetricsRecorder } from "../../base-CReh7d3E.cjs";
+import { t as MetricsRecorder } from "../../base-CUkmyaXJ.cjs";
 import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.d.ts

@@ -1,5 +1,5 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as MetricsRecorder } from "../../base-CReh7d3E.js";
+import { t as MetricsRecorder } from "../../base-CUkmyaXJ.js";
 import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-DiVQhHIw.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("../logger-BkMMCFTv.cjs");
-const require_authorize = require("../authorize-CB35c3Wg.cjs");
+const require_logger = require("../logger-CN1q-KNn.cjs");
+const require_authorize = require("../authorize-ChY44o_1.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
-import { i as log, r as describeError } from "../logger-rGakBvJ1.js";
-import { d as finalizeWireResponse, f as methodNotAllowed, i as oauthConfigurationErrorResponse, o as resolveProtectedResource, p as corsPreflightResponse, r as getOAuthRuntime, u as JSON_HEADERS } from "../authorize-FOlzhxrM.js";
+import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
+import { d as finalizeWireResponse, f as methodNotAllowed, i as oauthConfigurationErrorResponse, o as resolveProtectedResource, p as corsPreflightResponse, r as getOAuthRuntime, u as JSON_HEADERS } from "../authorize--rUeMOGU.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {

package/dist/protocols/rest/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_list_tools = require("../../list-tools-DiMCRunS.cjs");
-const require_rest = require("../../rest-1Pf9sYNU.cjs");
+const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
+const require_rest = require("../../rest-BE05MUNS.cjs");
 exports.createInvokeToolHandler = require_rest.createInvokeToolHandler;
 exports.createListToolsHandler = require_list_tools.createListToolsHandler;

package/dist/protocols/rest/index.d.cts

@@ -1,7 +1,7 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as MetricsRecorder } from "../../base-CReh7d3E.cjs";
+import { t as MetricsRecorder } from "../../base-CUkmyaXJ.cjs";
 import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-Cn7tpE0V.cjs";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-BN97L2Yv.cjs";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.d.ts

@@ -1,7 +1,7 @@
 import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as MetricsRecorder } from "../../base-CReh7d3E.js";
+import { t as MetricsRecorder } from "../../base-CUkmyaXJ.js";
 import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-Bku6XkVc.js";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-BAqQVIHk.js";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.js

@@ -1,3 +1,3 @@
-import { n as createListToolsHandler } from "../../list-tools-Dt-mhh52.js";
-import { t as createInvokeToolHandler } from "../../rest-Cit2862S.js";
+import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
+import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
 export { createInvokeToolHandler, createListToolsHandler };

package/dist/{rest-1Pf9sYNU.cjs → rest-BE05MUNS.cjs}

@@ -1,8 +1,8 @@
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_authorize = require("./authorize-CB35c3Wg.cjs");
+const require_authorize = require("./authorize-ChY44o_1.cjs");
 const require_content = require("./content-NCYIGgOb.cjs");
-const require_gate = require("./gate-B9RSzvoI.cjs");
-require("./list-tools-DiMCRunS.cjs");
+const require_gate = require("./gate-CGZl0gjJ.cjs");
+require("./list-tools-DCF6G4fn.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;

package/dist/{rest-Cit2862S.js → rest-BS7bBOd9.js}

@@ -1,8 +1,8 @@
 import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DSe96Ffd.js";
-import { f as methodNotAllowed, l as nowMs, n as createRequestAuthorizer, t as assertRestResourceBinding, u as JSON_HEADERS } from "./authorize-FOlzhxrM.js";
+import { f as methodNotAllowed, l as nowMs, n as createRequestAuthorizer, t as assertRestResourceBinding, u as JSON_HEADERS } from "./authorize--rUeMOGU.js";
 import { t as extractTextContent } from "./content-D5LJAHyM.js";
-import { t as createGatedHandler } from "./gate-BeHmyGxk.js";
-import "./list-tools-Dt-mhh52.js";
+import { t as createGatedHandler } from "./gate-BiM6EBeA.js";
+import "./list-tools-BLGr7mot.js";
 import { getParseErrorMessage, objectFromShape, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;

package/dist/stacks/supabase/index.cjs

@@ -1,11 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_logger = require("../../logger-BkMMCFTv.cjs");
-const require_authorize = require("../../authorize-CB35c3Wg.cjs");
+const require_logger = require("../../logger-CN1q-KNn.cjs");
+const require_authorize = require("../../authorize-ChY44o_1.cjs");
 const require_metadata_path = require("../../metadata-path-zd7NSNoa.cjs");
-const require_mcp = require("../../mcp-ECo1Ixk8.cjs");
+const require_mcp = require("../../mcp-CUGwXkxb.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-DiMCRunS.cjs");
-const require_rest = require("../../rest-1Pf9sYNU.cjs");
+const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
+const require_rest = require("../../rest-BE05MUNS.cjs");
 const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");
 //#region src/stacks/supabase/handler.ts

package/dist/stacks/supabase/index.js

@@ -1,10 +1,10 @@
-import { s as trimTrailingSlash } from "../../logger-rGakBvJ1.js";
-import { a as assertResourcePathShape, s as createRecorderForRuntime } from "../../authorize-FOlzhxrM.js";
+import { s as trimTrailingSlash } from "../../logger-Ctv5xUSD.js";
+import { a as assertResourcePathShape, s as createRecorderForRuntime } from "../../authorize--rUeMOGU.js";
 import { t as OAUTH_PROTECTED_RESOURCE_METADATA_PATH } from "../../metadata-path-CAkNcfyY.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DiVQhHIw.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-Dt-mhh52.js";
-import { t as createInvokeToolHandler } from "../../rest-Cit2862S.js";
+import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
+import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
 import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";
 //#region src/stacks/supabase/handler.ts

package/dist/stacks/supabase/vite.cjs

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_package = require("../../package-BdaLbzEh.cjs");
+const require_package = require("../../package-CGLPZwz-.cjs");
 const require_fs_errors = require("../../fs-errors-CWNzOV75.cjs");
 const require_supabase_config = require("../../supabase-config-Dz7dnUv0.cjs");
 const require_paths = require("../../paths-OP318a6c.cjs");

package/dist/stacks/supabase/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-BzTGjG_c.cjs";
+import { t as McpPluginApi } from "../../io-VBHO8YH_.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io--MeYrWG7.js";
+import { t as McpPluginApi } from "../../io-SMlD5WeX.js";
 import { Plugin } from "vite";
 //#region src/stacks/supabase/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/supabase/vite.js

@@ -1,4 +1,4 @@
-import { t as version } from "../../package-dtiombMt.js";
+import { t as version } from "../../package-DgiA0xuY.js";
 import { t as isFileMissing } from "../../fs-errors-PA2t1TIp.js";
 import { t as readSupabaseProjectRef } from "../../supabase-config-CakTU8YF.js";
 import { n as assertFunctionName, t as FUNCTIONS_MOUNT_PREFIX } from "../../paths-IS65L6TA.js";

package/dist/stacks/tanstack/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_authorize = require("../../authorize-CB35c3Wg.cjs");
-const require_mcp = require("../../mcp-ECo1Ixk8.cjs");
+const require_authorize = require("../../authorize-ChY44o_1.cjs");
+const require_mcp = require("../../mcp-CUGwXkxb.cjs");
 const require_protocols_oauth_metadata = require("../../protocols/oauth-metadata.cjs");
-const require_list_tools = require("../../list-tools-DiMCRunS.cjs");
-const require_rest = require("../../rest-1Pf9sYNU.cjs");
+const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
+const require_rest = require("../../rest-BE05MUNS.cjs");
 const require_forwarded = require("../../forwarded-Bhwcj22u.cjs");
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";

package/dist/stacks/tanstack/index.js

@@ -1,8 +1,8 @@
-import { s as createRecorderForRuntime } from "../../authorize-FOlzhxrM.js";
-import { t as createMcpProtocolHandler } from "../../mcp-DiVQhHIw.js";
+import { s as createRecorderForRuntime } from "../../authorize--rUeMOGU.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
 import { createOAuthProtectedResourceMetadataHandler } from "../../protocols/oauth-metadata.js";
-import { n as createListToolsHandler } from "../../list-tools-Dt-mhh52.js";
-import { t as createInvokeToolHandler } from "../../rest-Cit2862S.js";
+import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
+import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
 import { t as applyForwardedOrigin } from "../../forwarded-BlLF3dfc.js";
 //#region src/stacks/tanstack/handlers.ts
 const STACK = "tanstack";

package/dist/stacks/tanstack/vite.d.cts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io-BzTGjG_c.cjs";
+import { t as McpPluginApi } from "../../io-VBHO8YH_.cjs";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/dist/stacks/tanstack/vite.d.ts

@@ -1,4 +1,4 @@
-import { t as McpPluginApi } from "../../io--MeYrWG7.js";
+import { t as McpPluginApi } from "../../io-SMlD5WeX.js";
 import { Plugin } from "vite";
 //#region src/stacks/tanstack/vite.d.ts
 interface McpPluginOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {